[loopx-agent]

Goal And Delivered Outcome

A real native Turn could validate an artifact for the admitted Todo body, then mark a concurrently changed body done and consume quota. The immutable baseline reproduces this on both File and SQLite, including a changed requirement beyond the display preview.

Completion now binds the captured full Todo text to the existing atomic terminal owner. A changed body is refused; note edits and unrelated Todo changes remain compatible. Already accepted effects recover by their original receipt before checking fresh source state.

• Outcome basis: the existing M7.4 requirement/context and exactly-once settlement convergence checkpoint.
• Intended base: main; complete bounded bug fix within the existing convergence program.

Author Declaration

• Written by: model_agent — OpenAI Codex, submitted as LoopX Agent.
• Specification: Agent Loop Effect Interpreter: Heartbeat and Turn Envelope convergence, revision 5fb961c363c125589f3c0dd3d2cefd017c7b4f4e.

Criterion	Disposition	Owning path / evidence
Capture full authoritative requirements and reject stale mutation	implemented	Existing TS interaction owner stamps source verification; turn_todo_writeback.py hashes the captured exact bytes; terminal owner compares the canonical body under provider CAS.
Recover exactly once without rerunning accepted effects	implemented for this completion boundary	File/SQLite real CLI and provider conformance cover response loss, changed source after acceptance and cached replay.
Preserve compatibility during an in-place version upgrade	implemented for saved Turn completion	Old packets without captured proof refuse a fresh completion. Explicit missing-proof input preserves the original fingerprint so an already accepted legacy receipt still recovers. Unscoped/manual completion callers retain their contract.
Installed host adoption, model value and complete costs	deferred	Existing convergence checkpoint remains open; no live model or installed App/Lark claim.

Scope And Continuation

The producer carries one verified-source witness and reuses the existing full-body/reference carriers. Python performs reference resolution and byte hashing; TypeScript retains source admission and terminal decisions. The source check and completion share the existing canonical transaction and CAS. Only definite typed authority refusals become failed effects; unavailable or lost responses retain receipt recovery.

The final no-followup path intentionally keeps its existing order: writeback and spend may already be accepted before terminal completion is refused. Replay preserves that prefix without duplicate spend. This PR does not claim atomicity of the entire settlement or close the parent convergence program. The paired RFC checkpoint records that remaining boundary.

The same-domain simplification removes duplicate source metadata from the context transport while preserving full instructions and historical packet signatures. Existing CLI output budgets are unchanged. There is no new configuration, public CLI option, provider or lifecycle owner.

Validation

• Tested revision: 2fd007378d9730cf4f53806dfc61b207e313f827.
• Run state: finished.
• Input classes: synthetic, public_fixture.

Check kind	Result	Evidence / limitation
real_entrypoint	passed	374 focused Python cases, including 28 source/legacy cases in tests/control_plane/test_turn_completion_source.py; actual File/SQLite native CLI with independent artifact validation and concurrent source edits. Covers ordinary and final-no-followup ordering, exact full-body comparison, note/peer parity, retry and old receipt recovery.
unit	passed	npm run test:control-plane: 5,154 passed, 73 conditional integration skips; TS typecheck passed. Required real PostgreSQL runs are separate below.
real_backend	passed	Isolated real PostgreSQL 16: all 368 provider conformance and 2 service cases passed at the tested head, including terminal source/CAS/receipt behavior.
integration	passed	A newly built non-editable wheel passed 31 native source/recovery cases. All 1,149 loaded product modules came from the wheel; all nine changed product blobs matched source; child processes used the installed package.
regression_parity	passed	Immutable baseline wrongly completes changed requirements on File and SQLite. Disabling only the atomic guard in the final wheel makes the public CLI oracle fail; restoring exact package bytes makes it pass.
static	passed	Changed Python Ruff, configured mypy targets, TS typecheck, paired RFC diff, public/private scan and semantic vocabulary advisory. The advisory is limited to supported carriers and does not certify prose semantics.
integration	passed	Six direct premerge checks and 19 selected catalog/risk/boundary canaries; CLI output matrix passes its original size, growth, line and semantic limits.
integration	passed	Dashboard coverage lane; Chat assets rebuilt against the final shared contracts; wheel build completed.
integration	failed — merge hold	Required node apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-contract.test.mjs exits 7 at the Goal display-name assertion, line 378. Independent immutable baseline and final-head runs have identical complete failure signatures after checkout-root normalization. The required failure remains blocking.
manual	blocked	The recorded CQR decision failed on the required frontend check. Passing requalification for the current base/diff is still required. Overall premerge is held; CI failures are attributed below and independent PR review remains pending.

Coverage proves this source-bound completion slice, including real backends and packaged execution. It does not prove installed host adoption, live model decisions, overall outcome improvement or whole-settlement atomicity. No merge, release or live installation is included.

Frontend / Visual Evidence

• UI impact: none. This uses the existing native Turn operation and error/retry path; it adds no screen, setting or capability entrypoint.
• Before / after / first viewport: N/A. Existing full Markdown instructions and context elision are preserved; the added witness is machine metadata.
• Source data: synthetic, public_fixture.

Type of Change / Area

• Bug fix
• Test update
• Documentation update
• Control plane (todos, runtime and context delivery)
• Technical direction: existing M7.4 / roadmap S2/S3/S6/S8 convergence checkpoint.
• Shared-authority fixture impact: source-text admission and terminal CAS/replay; File/SQLite/native/legacy schema conformance and real PostgreSQL tested. No provider promotion, routing or compatibility-projection migration is performed.

Boundary Checklist

• Public-safe diff and body: no private state, credentials, raw traces, internal links or local machine paths.
• Scoped repair; no benchmark execution or scoring change.
• Both existing RFC mirrors change; exact-head bilingual check passes.
• UI impact marked none.
• DCO sign-off is present on the single commit.

Current CI Failure Attribution

CI tested immutable merge ea373819ecb31b283139662fa7298c586f5f2806, combining this source head with target db4b000cf1926dff66a67c3d4f343a080a37bb07. The affected files below match that target's Git blobs; this PR did not edit them. Required failures remain blocking.

Failed jobs	Observed cause	Evidence
Release browser and three Chat browser shards	Registered Goal display-name assertion, exit 7, in the existing Personal Workspace contract.	Release run, test run
TypeScript core and minimum Node	Seven TS18047 errors for nullable previous in conversation_binding.ts, lines 500–506 and 563. The CI target includes the later private-routing change; the original source head retains the earlier version of this file.	TypeScript job, minimum Node job
Windows PowerShell	Two existing mocked-clock cleanup tests reject 0.10000000000002274 <= 0.1. No native Windows success is claimed.	Windows job
Required matrix aggregation	Dependent qualification jobs failed.	test run

The source validation above remains evidence for the tested source commit. It is not a passing qualification of the CI merge or a baseline waiver.